Chapter 8 — Computer architecture
Lesson map
Lesson 08 published. Map, example, EX022.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Packet processing"]
N2["8.2 Fast and slow paths"]
N3["8.3 Memory and state tables"]
N4["8.4 Feature cost"]
N5["Encryption offload"]
N6["Hardware lifecycle"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX022"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Packet processing"]
N2["8.2 Fast and slow paths"]
N3["8.3 Memory and state tables"]
N4["8.4 Feature cost"]
N5["Encryption offload"]
N6["Hardware lifecycle"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX022"]
[Learning outcomes]
|
v
[8.1 Packet processing]
|
v
[8.2 Fast and slow paths]
|
v
[8.3 Memory and state tables]
|
v
[8.4 Feature cost]
|
v
[Encryption offload]
|
v
[Hardware lifecycle]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX022]
Learning outcomes
You will (1) describe how network devices process packets; (2) understand fast and slow paths; (3) relate hardware limits to security features.
8.1 Packet processing
Switches and routers forward packets using specialised hardware that looks up destinations quickly. Firewalls do more: they track connection state and evaluate rules. Some work happens in fast hardware paths, some in a general-purpose processor.
Each packet arriving at a router or firewall goes through steps: it is received, its headers are parsed, a forwarding or policy decision is made, and it is queued for output. Every step costs time and processing capacity. Understanding this pipeline explains why enabling extra inspection features reduces throughput, and why the stated capacity of a device depends on which features are switched on.
8.2 Fast and slow paths
New connections often go through a slower path for rule evaluation; later packets of the same connection follow a fast path using cached state. A sudden surge of new connections can therefore load a firewall more than high throughput on existing ones.
Many devices handle ordinary packets on a fast path, often in dedicated hardware, while unusual packets go to a slower general processor. Packets needing logging, fragmentation handling or certain options may take the slow path. If a design causes much traffic to be logged individually, the slow path can become a bottleneck, so engineers check which features force slow-path handling before enabling them widely.
8.3 Memory and state tables
Stateful firewalls hold a table of active connections. Each entry uses memory; the table has a maximum size. Kofi notes table capacity when sizing firewalls for council sites.
Stateful firewalls remember each active connection in a table. The table has a fixed size, so a sudden increase in connections, whether from a legitimate surge or a fault, can fill it, after which new connections are refused. Engineers size tables from measured peak connection counts with headroom, and monitor table usage so they are warned before it becomes full.
8.4 Feature cost
Enabling deep inspection or decryption uses more processor time, lowering throughput. Vendors publish separate throughput figures for these features, which Kofi compares with expected load.
Vendor data sheets often quote throughput with few features enabled. With deep inspection, logging and encryption switched on, real capacity can be much lower. Engineers ask for figures under the planned configuration, or test in a lab with representative synthetic traffic, before relying on a device in production.
Monitoring processor and memory load after enabling a feature confirms whether the estimate held.
Encryption offload
Encrypting inter-office tunnels with IPsec uses processor time for every packet. Many firewalls include hardware that accelerates the cryptographic operations, so tunnel throughput depends heavily on whether this offload is available for the chosen algorithms. NIST SP 800-77 Rev. 1 recommends modern algorithms such as AES in GCM mode, which are commonly accelerated. Kofi checks that candidate devices accelerate the algorithms he intends to use, because a device that falls back to software encryption could become the bottleneck for backups between offices.
Hardware lifecycle
Network security devices receive firmware updates that fix flaws and add features, but only for as long as the vendor supports the model. A firewall bought near the end of its product life may stop receiving updates within a few years. Kofi records the vendor's published end-of-support dates for each candidate and prefers models with at least five years of remaining support. He also notes that firmware updates usually require a reboot, which shapes the redundancy design: with a pair of firewalls, one can be updated while the other carries traffic.
Worked example
A candidate firewall rated 5 Gb/s plain but 1 Gb/s with inspection is adequate for a 400 Mb/s site with margin.
Synthetic case. Specifications are synthetic.
Errors and limits
Datasheet figures are measured under ideal conditions; plan with margin.
Exercises
- EX022 — Connection surge. Why can many new connections stress a firewall more than high throughput? Rubric: 3 = slow path per new connection;; 2 = slow path;; 1 = vague;; 0 = none.
- EX023 — State table. What happens when the state table is full? Rubric: 3 = new connections dropped or evicted;; 2 = failures;; 1 = vague;; 0 = none.
- EX024 — Margin. Why size firewalls with margin over datasheet figures? Rubric: 3 = ideal conditions, growth;; 2 = safety;; 1 = vague;; 0 = none.
Synthesis
Understanding packet paths explains why security features affect performance.
Continue studying — chapter 08 of 50
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →